Hardcoded credentials, PHI exposure, insecure data storage, and missing encryption are the security risks healthcare leaders report most often in AI-generated code. In a July 2026 Paubox survey of 151 healthcare leaders, more than half (54%) said AI-generated or AI-assisted code has contributed to hardcoded credentials or API keys at their organization.

The findings come from The CISO's guide to healthcare AI governance, Paubox's report on how healthcare organizations govern the software staff build with AI coding assistants.

Four issues cluster at the top

Healthcare leaders were asked which security or privacy issues AI-generated or AI-assisted code has contributed to at their organization.

Security and privacy issues healthcare leaders say AI-generated code has contributed to: hardcoded credentials or API keys 54%, exposure of PHI 51%, insecure data storage 51%, missing or inadequate encryption 44%, software vulnerability or coding bug 30%. Paubox survey of 151 healthcare leaders, July 2026.

The survey's margin of error is plus or minus 8 points, so the first four issues sit too close together to rank. They're best read as one group, each reported by between 44% and 54% of healthcare leaders.

Software bugs came in lowest, at 30%. The four issues above it touch credentials and patient data directly.

Hardcoded credentials travel with the code

MITRE's Common Weakness Enumeration defines the flaw plainly: "The product contains hard-coded credentials, such as a password or cryptographic key."

When an API key sits in the source code, anyone who can read the code can use the key. That includes everyone with repository access, every copy of the code, and anything pasted into a prompt for help with a bug. For a tool that connects to systems holding PHI, a leaked key can open a path to patient data.

The fix is to keep secrets out of code entirely. Store keys in a secrets manager or environment configuration, rotate any key found in a repository, and add a scan for hardcoded secrets to the review step.

Half of healthcare leaders report PHI exposure and insecure storage

Half of healthcare leaders (51%) say AI-generated code has contributed to PHI exposure, and the same share report insecure data storage.

The two often go together. When a tool writes patient data to an unprotected file, a debug log, or an open storage bucket, anyone who reaches that location can read the PHI. AI-built tools can also go live without anyone checking where they keep data: seven in ten healthcare leaders (70%) say their organization has found an AI-built tool that handled PHI without IT or security knowing.

The HIPAA Security Rule's technical safeguards apply to these tools the same way they apply to any system holding electronic PHI, including access controls and audit controls.

Encryption gaps leave patient data readable

More than four in ten healthcare leaders (44%) say AI-generated code has contributed to missing or inadequate encryption.

The Security Rule calls for a mechanism "to encrypt and decrypt electronic protected health information" and for transmission security measures that "guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network." Encryption is an addressable specification, so an organization that skips it has to document why. Paubox explains the difference in What is HIPAA's encryption and decryption standard?

AI-built tools that send patient messages are a common place for this gap to show up, because each tool may handle its own email sending. Routing those messages through a service that encrypts by default removes the step a developer, or an AI coding assistant, could miss. The Paubox Email API sends HIPAA compliant email with TLS 1.2 or higher by default.

How to scan AI-built tools for these four issues

Start with a list of tools

Scanning only works on tools someone knows about. Build an inventory of every AI-built tool, whether it handles PHI, and who owns it.

Read also: How to govern AI-built tools in healthcare, starting with an inventory

Check each tool for secrets in code

Search each tool's code and history for hardcoded passwords, tokens, and API keys. Rotate anything found, and move secrets into managed storage.

Trace where each tool stores patient data

Confirm every location a tool writes PHI to, including logs, temporary files, and test databases, and check that each one has access controls.

Confirm encryption in transit and at rest

Verify that each tool encrypts PHI it stores and every connection it uses to send PHI, including email.

Make the checks part of review

Add all four checks to the pre-deployment review, so each new tool is scanned before it handles PHI.

Go deeper: The CISO's guide to healthcare AI governance

FAQs

What is a hardcoded credential?

A hardcoded credential is a password, token, or API key written directly into a program's source code. Anyone who can read the code can use it. MITRE tracks it as CWE-798.

Does HIPAA require encryption for AI-built tools?

Encryption is an addressable specification under the HIPAA Security Rule. Organizations must implement it or document why an alternative is reasonable. Paubox covers the details in What are HIPAA email encryption requirements?

Do AI-built tools that handle PHI fall under HIPAA?

Yes. A tool that creates, receives, maintains, or transmits PHI falls under HIPAA however it was built. The CISO's guide to healthcare AI governance covers how healthcare organizations govern them.